Alert when a host is no longer sending data to Splunk.Alert when CPU or memory utilization rises above 95%.Search logs and events on a host to more quickly investigate an incident.View CPU, disk, memory and network utilization across every Linux and Windows host in your environment.In this section we’ll cover the steps necessary to allow you to: Collect, Visualize and Monitor Host Infrastructure Finally, we’re assuming that you have access to a Splunk administrator or Splunk team that has a decent understanding of how to manage and deploy new configurations via the deployment server or other methods and can help deploy the changes outlined in this blog.
We’re assuming that most or all of the infrastructure you’d like to monitor already has the Universal Forwarder installed. We’re assuming you already have access to a Splunk environment where you can send data. Through the rest of this blog, we’re going to make some assumptions about your environment resulting in some guidance and detail not being covered in this blog. Check out the blog post, " Sunburst Backdoor Detections in Splunk," for more information. Splunk’s security experts are diligently working to provide guidance to help detect activity from, and protect your network against Sunburst Backdoor malware.
So with that in mind, we wanted to provide the following immediately actionable steps to help manage the risk created by the Sunburst Backdoor: Chances are good that, if you are reading this post, then you already have Splunk within your environment and that you already have Universal Forwarder deployed to your most critical infrastructure. This blog was written to give you guidance that can be acted on quickly to produce maximal outcomes with minimal cost and effort. To do this, we’ll introduce you to Splunk’s infrastructure monitoring and troubleshooting capabilities that can help you recover much of the visibility lost when Orion was shut down.
If you are considering a similar response in your own environment, a critical next step is quickly restoring the lost visibility to the health and operations of your infrastructure. government organizations following the recent CISA guidance. The news of the “Sunburst Backdoor” malware delivered via SolarWinds Orion software has organizations choosing to shut down Orion to protect themselves.
0 kommentar(er)
